Catalyst CMMS — Privacy Policy (DRAFT)
DRAFT — prepared for internal review; not yet reviewed by an attorney; not in effect.
Quick note: Koda is not a lawyer. This draft describes what the product actually does with data today — verified against the code, not copied from generic SaaS boilerplate — as a starting point for Kevin's review and an attorney's glance before launch. Bracketed items are decisions that still need to be made.
Effective date: [TBD — launch, November 30, 2026]
Catalyst CMMS is operated by Catalyst CMMS Solutions, LLC, a Missouri limited liability company located in St. Louis, Missouri ("Catalyst," "we," "us"). Catalyst is business software: organizations subscribe, and their staff use it to run maintenance operations. This policy explains what information the Service collects, why, who it is shared with, and the choices organizations and their users have.
In this policy, "Customer Data" means the operational records an organization puts into the Service. The organization is responsible for the Customer Data its users enter; we process it to provide the Service, as described below.
1. Information we collect
Account information. For each user account: name, work email address, role and permissions, and a password stored only as a salted cryptographic hash (we never store passwords in readable form). Organizations may also keep contact details for their own personnel in the Service (for example, a phone number on a technician record used for text-message alerts, if the organization enables them).
Customer Data (your organization's operational records). Work orders, preventive-maintenance schedules, asset and fleet records, location records, compliance logs (such as food-safety, cold-chain, calibration, and sanitation records), inventory and purchasing records, projects, messages between your users, service requests submitted through your public request portal, and files your users upload (photos, documents, your organization's logo). Service requests submitted through a public portal include the requester's name and the contact details they provide.
Billing information. Subscriptions are handled by Stripe. We receive and store subscription status, plan, seat counts, billing-period information, and a Stripe customer identifier. We never see or store full card numbers — payment details go directly to Stripe.
Technical and usage information. Server and security logs (including IP addresses used in sign-in protection, timestamps, and actions taken), audit trails of significant in-Service activity that the Service keeps for the organization itself, integration sync logs, push-notification subscription endpoints for devices a user opts in, and notification delivery records. Session tokens are kept in the browser's session storage and disappear when the tab closes.
Support communications. If you contact us, we keep the conversation so we can help you and follow up.
2. How we use information
- To provide and operate the Service for your organization: running work orders, schedules, reminders, notifications, reports, and the other features your plan includes.
- To bill for subscriptions and manage seats, through Stripe.
- To send operational notifications the Service is designed to send — for example, work-order assignments, due-date reminders, low-stock alerts, and billing notices — by in-Service notification, email, optional text message, and optional device push, according to each user's preferences and your organization's configuration.
- To secure the Service: authenticating users, enforcing organization-level access isolation, throttling failed sign-ins, keeping audit trails, and investigating misuse.
- To provide support, including implementation assistance your organization requests (support access to an organization's data is logged).
- To improve the Service using aggregated, de-identified information that does not identify any organization.
We do not sell personal information. We do not use Customer Data for advertising, and the Service contains no advertising trackers or third-party analytics.
Product email is operational (notifications, reminders, billing). [TBD: if Catalyst ever sends a product newsletter or marketing email, it will be opt-in and this policy will be updated first — no marketing email is sent today.]
3. The Maintenance Copilot (AI feature)
On the Premier plan, users may use the Maintenance Copilot. When a user asks the Copilot a question, the Service sends the question — together with operational context the Copilot retrieves from your own organization's records (such as equipment details, open work orders, upcoming preventive maintenance, and parts stock) — to Google's Gemini AI service, which generates the answer. This happens only when a user uses the Copilot; no Customer Data is sent to Google otherwise. Copilot work-order output is a draft that a human reviews and saves; the Copilot does not change your records on its own. [TBD — confirm before launch: the Google AI terms applicable to the API key in use, and whether Google retains or trains on API inputs under those terms, should be verified and this section updated to match.]
4. Who information is shared with
We share information only with the service providers needed to run the Service, and with third parties your organization connects:
| Recipient | What they receive | Why |
|---|---|---|
| Fly.io | The Service's hosted data (hosting) | Runs the application and its database |
| Stripe | Billing contact details, subscription and seat information; card data goes to Stripe directly | Payment processing and billing portal |
| Google (Gemini) | Copilot questions and retrieved operational context — only when your users use the Copilot | AI answers (Copilot — included on all plans) |
| Browser/OS push services (e.g., Google, Apple, Mozilla) | Notification title/body and a subscription endpoint, only for devices a user opts in to push | Delivering web push notifications. Push is served from our own server using our own keys; there is no separate marketing or push vendor |
| Your organization's own email provider | Notification and report emails the Service sends | Outgoing email is sent through the mail provider your organization configures in the Service, not through a Catalyst marketing platform |
Customer-directed integrations. If your organization connects a third-party service, data flows to it only under your configuration and your own account with that provider — for example: Intuit QuickBooks Online (approved purchase orders become bills in your QuickBooks company), Samsara (fleet readings, using your own Samsara token), Slack / Microsoft Teams (notification messages to channels you select), Twilio (text-message alerts to your personnel, if enabled), and Google or Microsoft sign-in (single sign-on; identity information to authenticate users you already have). Disconnecting an integration stops the flow.
Other limited cases. We may disclose information if required by law or legal process, to protect the security or rights of Catalyst, our customers, or others, or in connection with a sale of our business or assets (with the buyer bound to this policy for data collected under it).
5. Security
We protect information with measures including: passwords stored as salted hashes; sign-in throttling against repeated failed attempts; organization-level isolation enforced on every data request, so one organization's records are not accessible to another; hashed, scoped, revocable API keys; signed webhooks for billing events; automatic database backups with tiered retention, stored with the hosted application; and audit logging of significant activity. Transmissions to the Service are encrypted in transit (HTTPS). No system is perfectly secure; if we become aware of a breach affecting your information, we will notify affected organizations as described in [BREACH NOTIFICATION COMMITMENT — TBD: timing and method, e.g., without unreasonable delay / within a stated number of days — attorney to advise].
6. Retention
We keep account information and Customer Data while an organization's subscription is active, and afterwards as described in the Terms of Service: Customer Data is retained for [RETENTION WINDOW — TBD: must match the Terms, e.g., 30 / 60 / 90 days] after termination to allow a final export, then deleted or de-identified, except where law requires longer retention. Backup snapshots age out on their normal cycle (the oldest are pruned within about a week of creation). Deactivated user accounts are retained in the organization's records so historical work records stay accurate; an organization administrator can ask us about removal via the contact below.
7. Your choices and rights
- In the Service: administrators manage their organization's users, roles, and data, and can deactivate accounts. Users control their own notification preferences, including email, text-message, and push alerts. The Service's export tools let administrators export the organization's records in common formats at any time during the subscription.
- By request: depending on where you live, you may have rights to access, correct, or delete personal information, or to object to or limit its use. Because most personal information in the Service belongs to an organization's records, we may direct a request to that organization's administrator — your employer or the organization whose Service you use — and we will support them in responding. Individuals may also contact us directly at [CONTACT EMAIL — TBD, mailboxes not yet live], and we will respond as the law requires.
- Cookies and storage: the Service uses only the browser storage it needs to function — a session token in session storage and product preferences. It sets no advertising cookies and runs no cross-site tracking.
8. Children
The Service is business software, offered to organizations for their staff. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided information through the Service, contact us and we will remove it.
9. Changes to this policy
We may update this policy. When we do, we will post the updated version in the Service and update the effective date, and for material changes we will notify organization administrators by email or in-Service notice before the change takes effect.
Contact: Catalyst CMMS Solutions, LLC · St. Louis, Missouri · [CONTACT EMAIL — TBD, mailboxes not yet live]
End of draft. Bracketed items are collected for Kevin's and an attorney's review; none of them are settled decisions.